ca_service.py 文件源码

def generate_ca_cert(self, cn, ou, o, expire_period=None, password=None):
        """CA ??? ??
        Peer ??? ?? ?? ???(ECC Key)

        :param cn: ?? CommonName
        :param ou: ?? OrganizationalUnitName
        :param o: ?? OrganizationName
        :param expire_period: ??? ????(year)
        :param password: ??? ??? ????(8?? ??)
        """
        sign_pri_key = ec.generate_private_key(ec.SECP256K1(), default_backend())
        sign_pub_key = sign_pri_key.public_key()

        subject_name = x509.Name([
            x509.NameAttribute(NameOID.COMMON_NAME, cn),
            x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, ou),
            x509.NameAttribute(NameOID.ORGANIZATION_NAME, o),
            x509.NameAttribute(NameOID.COUNTRY_NAME, "kr")
        ])

        serial_number = self.__LAST_CA_INDEX + 1

        key_usage = x509.KeyUsage(digital_signature=True, content_commitment=False,
                                  key_encipherment=True, data_encipherment=False, key_agreement=False,
                                  key_cert_sign=True, crl_sign=False,
                                  encipher_only=False, decipher_only=False)

        if expire_period is None:
            expire_period = self.__ca_expired

        new_cert = self.__generate_cert(pub_key=sign_pub_key, subject_name=subject_name,
                                        issuer_name=subject_name, serial_number=serial_number,
                                        expire_period=expire_period, key_usage=key_usage,
                                        issuer_priv=sign_pri_key)

        cert_pem = new_cert.public_bytes(encoding=serialization.Encoding.PEM)
        if password is None:
            pri_pem = sign_pri_key.private_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PrivateFormat.PKCS8,
                encryption_algorithm=serialization.NoEncryption()
            )
        else:
            pri_pem = sign_pri_key.private_bytes(
                encoding=serialization.Encoding.DER,
                format=serialization.PrivateFormat.PKCS8,
                encryption_algorithm=serialization.BestAvailableEncryption(password=password)
            )

        self.__save(self.__CA_PATH, cert_pem, pri_pem)
        self.__LAST_CA_INDEX += 1
        self.__show_certificate(new_cert)